Skip to content

Use a FIDO2 security key as Azure MFA verification method

This news seems to be kept under the radar a little bit, but I wanted to point out a new feature in Azure AD that might help out some organizations with their Azure MFA implementations. Take a look at this list of supported authentication methods, and notice that passwordless methods can also be used as a form of verification for Azure AD Multi-Factor Authentication: Microsoft Authenticator app Windows Hello for Business FIDO2 security key OATH hardware token (preview) OATH software… 

Read More »Use a FIDO2 security key as Azure MFA verification method

Get alerts on Azure resource assignments made outside PIM

Microsoft released a new public preview where admins can be alerted when assignments to Azure resources are made outside of Privileged Identity Management. This was already possible in combination with Azure AD roles, but the new preview now applies to Azure resources as well. Where alerts on Azure AD roles are enabled by default, alerts for Azure resources need to be enabled by an administrator first. This feature is extremely valuable when you want to govern your Privileged Access implementation,… 

Read More »Get alerts on Azure resource assignments made outside PIM

Dynamic Administrative Units using on-prem Organizational Units

Gone are the days that I could start a workshop, session, or training with: “Do you know the big difference between Active Directory and Azure Active Directory? Azure AD is flat, where AD is not.” Well…… If there is one thing I’ve learned over the last years: it’s hard to do Zero Trust in a flat landscape. Lucky for us, we have Administrative Units nowadays. I really love Administrative Units (AUs) as they bring scoping to Azure AD. Until recently,… 

Read More »Dynamic Administrative Units using on-prem Organizational Units

Get started with Azure AD B2B direct connect

We all love seamless collaboration, right? Well, here’s a new feature that might improve that experience. Today, we will talk about Azure AD’s cross-tenant access settings, and in particular, about Azure AD B2B direct connect. What is B2B direct connect? B2B direct connect is part of the cross-tenant access settings in Azure AD. These settings will give you granular control over how external Azure AD organizations collaborate with you (inbound access) and how your users collaborate with external Azure AD… 

Read More »Get started with Azure AD B2B direct connect

KB – Reset cross-tenant access policies back to the system default.

  • Entra
  • 2 min read

This is a knowledgebase item. Hope it helps you out someday. The issue Changes have been made to the default settings in the Azure AD cross-tenant policies. You want to revert them, but there is no button in the Azure portal UI to do that (at the moment of writing this article) Solution This can be done using the Graph API. The easiest way is using Graph Explorer. So, how does that work? Browse to https://aka.ms/ge, and make sure that… 

Read More »KB – Reset cross-tenant access policies back to the system default.

Multi-stage approval for privileged roles using Azure AD Identity Governance

Privileged Identity Management is a great feature within Azure AD to provide just-in-time access to your admin roles and Azure resources. But some roles may require an extra level of security, for the simple fact the role is highly privileged, and (hopefully) rarely used. With the current capabilities, you are able to activate an approval step, but that is only limited to one approver. In this article, I will show you how you can use Azure AD Identity Governance to create… 

Read More »Multi-stage approval for privileged roles using Azure AD Identity Governance

KB – mobile phone number not in sync Azure AD Connect

This is a knowledgebase item. Hope it helps you out someday. The issue Some users reported that the mobile phone number in Azure Active Directory / Office 365 was different from the number in on-prem Active Directory. Even though these users were synced with Azure AD Connect, the mobile phone attribute was no longer in sync. Cause After some investigation, it seemed that the affected accounts were previously edited with the Set-MsolUser cmdlet from the MSOnline PowerShell module. To make… 

Read More »KB – mobile phone number not in sync Azure AD Connect

Download Intune PowerShell scripts with Graph Explorer

This quick post will show an easy method to fetch your PowerShell scripts after you have uploaded them using the Intune management portal. Unfortunately, the portal does not provide a UI to download the script content as soon as you hit that save button. Graph Explorer to the rescue There are multiple ways to do this using PowerShell scripts. If you want to bulk download all the scripts in your tenant, I recommend using this method, created by Oliver Kieselbach.… 

Read More »Download Intune PowerShell scripts with Graph Explorer

10 tips to secure your identities in Microsoft 365

I was recently invited by the Dutch Virtual Desktop User Group to present a session about Identity Security. Now, because this was in Dutch (my native language), I decided to do a ‘short’ write-up in English, so everybody can benefit from this. I shared 10 tips on how to secure your identities, but not before I showed how easy it is to phish Office 365 credentials, even if they are protected with MFA. You can also check the recording in… 

Read More »10 tips to secure your identities in Microsoft 365

Get started with multi-stage access reviews in Azure AD

Access reviews, part of the Azure AD Identity Governance module, is a great feature to reduce the risk associated with stale access assignments. Administrators can use Azure Active Directory (Azure AD) to create access reviews for group members or application access. Reviews can be delegated to group owners, managers, or specific users, but there is also the self-review option where users can review their own access. By default, this is a single-stage process. Now in preview, there is the option… 

Read More »Get started with multi-stage access reviews in Azure AD